Link Copied
Dear Vishal,
- OS version of the Server : Server 2022
- SQL version: 2022
- Location of both; (physical, virtual): Virtual / Azure IaaS - Windows VM
- Will they be on the same server machine? : Yes
- Authentication mode: Local, Azure AD, or Windows AD: Local for Tenant Admin, Azure AD for Global Admin
- Intel® EMA software version: Intel® EMA v1.14.3.0
- Number of endpoints to be provisioned: 200
- Will remote access to BIOS be necessary? : Yes (our only reason for this product)
- Location of endpoints: local or remote.: Local and Working from Home/Remote
- FQDN: ema.alphatrains.eu
---
When I disable WiFi - It works:
When I enable WiFi it becomes stuck on 2 Clients (Dell Latitude 7440 and Dell Latitude 7450)
Another client / showing a fancy Intel Logo the other one doesnt but result is the same:
Log file of the Managebility Server & Log from Client attached
I digged a bit deeper and found this. I configured some dummy WiFi, "AlphaTrains-Test" with 12345678 as password. This synced just fine:
Only difference is that I tried WPA CCMP + Simple Password. The profile syncs perfectly to the client.
As soon as I configure WPA2-PSK with our production SSID and complex password, the device seems to fail.
Why would that be? Surely the devices should support WPA2-PSK.
Also I noticed that if you login to the local EMA web-interface the settings are pushed properly:
CIRA still shows as disconnected, even though I deployed this AlphaTrains-Test WiFi..
So there seems to be 2 issues: CIRCA never connecting, also not when the client is in LAN or WiFi on OS-Level, and WiFi Profile seems to be too complex for AMT?
Thanks Vishal,
I resolved the WiFi issue
- TKIP is considered legacy and insecure, hence CCMP is enforced by the AMT Firmware (according to ChatGPT) this was a mistake on my end. I thought TKIP would be the better standard, however CCMP is better and thats also how our WiFi is configured.
- That explains why TKIP is not an option in the localhost/AMT Webinterface
- I configured the WiFi now to use CCMP
- Then I noticed, that it had problems with our 64 Char ASCII Passphrase. AMT only supports 64-char-HEX and 63 Char-Ascii passwords. So I removed 1 character from the password and the issue was resolved as well.
The Wifi now deploys correctly! No more "pending configuration"
However CIRA still shows as "Not connected"
I will proceed with your outlined troubleshooting steps.
443 and 8080 TCP are available over the internet, that should be enough when I preconfigure the device via USB-key or Dell Factory right?
I might add that as soon as I enable:
I have this error in the log:
2025-08-07 21:02:21.0502|WARN||9116|89|SetWirelessUefiWiFiProfileShareEnabledOption - MeshManageabilityServer.code.AmtSetup.WirelessManager, EMAManageabilityServer, Version=1.14.3.0, Culture=neutral, PublicKeyToken=57d11e903ea1ca2c - [1] - Unable to set UEFIWiFiProfileShareEnabled to True. : (ATPC-8KM59Y3,342CFF7D).
Exception Level(0):WSManFault.Code: a:Sender WSManFault.SubCode: e:UnsupportedFeature
StackTrace Level(0): at Intel.Manageability.WSManagement.DotNetWSManClient.WSManSendReceive(Header header, XmlElement[] bodyIn, XmlElement[]& bodyOut)
at Intel.Manageability.WSManagement.DotNetWSManClient.Put(Uri resourceUri, XmlElement content, IEnumerable`1 selectors)
at ManageabilityStack.AmtWireless.SetupUefiWiFiProfileShareEnabledOption(Boolean enabled)
at MeshManageabilityServer.code.AmtSetup.WirelessManager.SetWirelessUefiWiFiProfileShareEnabledOption(Boolean enabled)
However: Provisioning still completes without an error.
Could you please confirm, that this setting is not needed? If it is needed, how do I get this to work?
CCM
Logs attached
CIRA now shows as "Connecting..." but no success.
Network issue?
.tld issue?
Edit: After a few mins it goes to:
** CIRA Information ***
CIRA Server: Not Found
CIRA Connection Status: NOT_CONNECTED
CIRA Connection Trigger: USER_INITIATED
Dear Vishal,
after revising my config, reinstalling the certs, creating a new USB-Stick etc.
I got it working like this now:
- CIRAconnected
- Admin Control Mode
- Provisioning completed
- WiFi Profiles installed
- KVM via AMT, without consent works as expected, when the OS is online
- KVM via AMT does NOT work, when the OS is offline. e.g. "Reset to BIOS" - the device resets, and is showing the BIOS but I can't connect anymore
- CIRA is "Not connected" when the device is Out of Band
- CIRA is only connected when the device is In-Band
I went through all the hoops to make this software working, and now the most important part seems not to work? In my other topic I was told, that Out of Band Management only works when you purchased a certificate and provision devices in ACM mode.
Well, thats what I did now - and it still does not work?!
I have Dell Laptops with vPro Certification, so I'd expect this to work?
Re your message:
- The BIOS you linked is older than the BIOS I have installed (I have the latest BIOS: 1.22.0)
- I have installed the latest Management Engine Drivers from the Dell Support but have installed yours now. That surely won't fix my problem.
- Why does ACM and CIRA work In-Band, if my ".eu" tld is the problem?
Attached a new log
Is what I want to achieve feasible at all?
I have the certificate with .com tld now.
- Adjusted Entra ID login
- Adjusted Managebility Server FQDN
- WebServer FQDN
- Allowed Domains
- Uploaded the certs (PFX with password, and whole chain)
- Changed AMT AutoSetup Profile to use new Cert
- Restarted the whole server
- Recreated the USBStick with USBFile
- Uninstalled Agent
- Ran "C:\Program Files (x86)\Intel\EMAConfigTool\EMAConfigTool.exe" --unconfigure
- Went into F12>Intel Management Extension>Disable
- Rebooted
- Went into F12>Intel Management Extension>Enable
- Put the USB-Stick in, rebooted
- Applied config
- Reinstalled Agent
Even though CIRA was connected before (in ACM, but over the Agent, like you said) it's now "Not connected"
- Platform Manager didn't work anymore, so
- Went here C:\Program Files (x86)\Intel\Platform Manager\Platform Manager Server
- Updated settings.txt with new UPN
- Logged in, works
- Console still showing this weird MeshRoot, I'd expect it to show my PKI Cert??
- Confirmed with OpenSSL (see attached)
- Confirmed with EMAConfigTool (see attached)
If I can't get this to work this week, the next laptops were gonna buy as a company are going to be AMD. I'm so annoyed by this user-unfriendly software and cumbersome process.
Some more MeshCommander Screenshots:
Hello AlphaSeb,
Greetings!!
Thank you for changing to the supported certificate domain, as per the Intel document.
Please proceed to add the PKI DNS suffix in the MEBx settings by following the steps outlined in the article below:
Once completed, kindly share with us the latest ECT logs of the endpoint, so we can verify the configuration.
With that, also share us the screenshot from the Certificate tab as shown in the reference image below. You can access this by navigating to:
Manage User Certificates → Personal → Certificates → Select the certificate in question → Details
Please let us know if you need any assistance, and feel free to revert back to us at any time.
Best Regards,
Vishal Shet P
Intel Customer Support Technician
intel.com/vpro
Dear Vishal,
1) PKI DNS Suffix has been added, using the USBFile (setup.bin) + USB Stick method. The client log I have attached yesterday, so that should be visible to you:
2) Screenshot of the certificate installed in Computer/User Personal Store
The very same cert, is also installed here and detected as PKI Cert.
Would it possible to have a call during German business hours? This back and forth here is quite time consuming.
